Ensuring the provenance of passengers at a transportation facility

ABSTRACT

The provenance of passengers intending to depart on a vehicle from a transportation facility, is ensured by providing biometric reading devices at both a check-in station and a departure area station of the facility. The name and/or other information concerning a passenger arriving at the facility is also entered for assessment into a background check system. A biometric template of the passenger is acquired by the reading device at the check-in station and forwarded to the departure area station. When the passenger appears at the latter station, a second biometric template is acquired by the reading device there. The second template is compared with each of a number of templates that were forwarded from the check-in station. If no match exists, or if the background check system returns an unsatisfactory assessment, the passenger is refused boarding onto the vehicle.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a continuation under 35 U.S.C. §120 of U.S. patentapplication Ser. No. 11/823,338 filed Jun. 27, 2007, which claims thepriority benefit under 35 U.S.C. §119(e) of U.S. Provisional PatentApplication No. 60/805,925 filed Jun. 27, 2006, and entitled “Method forEnsuring the Provenance of Passengers in a Transportation System.”

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention concerns a system and process for ensuring theprovenance of passengers who intend to board a vehicle at atransportation facility such as, e.g., a commercial airport.

2. Discussion of the Known Art

Certain public transportation systems or facilities must ensure theprovenance of each passenger before allowing him or her to board avehicle such as a commercial aircraft at the facility. As used herein,“provenance” implies (i) knowledge that a given person who has checkedinto a transportation facility is the same person who later appears at adeparture area (gate) of the facility or who actually enters thevehicle, and (ii) knowledge of the person with respect to (a) theability of him or her to pass successfully through immigration or otherchecks on arrival, and (b) a security assessment based, for example, ona background check in order to quantify a risk the passenger might poseto other individuals (passengers or otherwise) if allowed to board thevehicle. Knowledge of both the mentioned items (i) and (ii) willtherefore allow a determination to be made of the passenger's overallfitness for travel through the facility.

U.S. Pat. No. 6,119,096 (Sep. 12, 2000) relates to a system and methodfor automated aircraft boarding and passenger billing, wherein passengercheck-in and boarding is determined by the use of an iris recognitionsystem in conjunction with associated passenger accounts. The patentdoes not address privacy issues concerning the anonymity of thebiometric record, or certain instances in actual deployments whereindata attempted to be acquired from the iris is insufficient alone forrecognition of a particular passenger (e.g., a blind person whoseeyelids are closed) without other information. In addition, the patentis not concerned with the fitness of prospective passengers for boardingand traveling on an aircraft, nor does it disclose particular billingmethods that may be optimal with respect to the transportation carrieror organization.

SUMMARY OF THE INVENTION

The present invention ensures the provenance of passengers in atransportation system without disrupting the flow of passenger movementthrough the system. The inventive system and process increases the levelof passenger provenance above levels afforded by the known automatedsystems, while at the same time allowing for rapid passenger throughput.

According to one aspect of the invention, a process for ensuring theprovenance of passengers in a transportation system includes providing afirst biometric reading device at a first station associated with acheck-in area of a transportation facility, providing a second biometricreading device at a second station associated with a departure orboarding area of the facility, acquiring a first biometric template of agiven passenger arriving at the check-in area using the first readingdevice, and entering a name or other information corresponding to thegiven passenger into a background check system.

The acquired first biometric template is forwarded from the firststation to the second station, and a second biometric template of thegiven passenger is acquired using the second reading device when thepassenger appears at the second station associated with the departure orboarding area. The second biometric template is compared with each of anumber of biometric templates forwarded to the second station from thefirst station and corresponding to all passengers who have checked infor departure on the same vehicle as the given passenger. The existenceof a match between the second biometric template and one of thebiometric templates forwarded from the first station is then determined.

For a better understanding of the invention, reference is made to thefollowing description taken in conjunction with the accompanying drawingand the appended claims.

BRIEF DESCRIPTION OF THE DRAWING

In the drawing:

FIG. 1 is a flow chart representing steps of a process for ensuring theprovenance of passengers, according to the invention; and

FIG. 2 is a block diagram of one embodiment of a system for implementingthe process of FIG. 1, according to the invention.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 is a flow chart showing various steps of the inventive processfor ensuring the provenance of passengers arriving at a transportationfacility for travel. FIG. 2 is a block diagram showing one embodiment ofa system for implementing the process according to the invention.

Basically, one or more stations are constructed and arranged to ensurethat a given person who arrives and checks in at a transportationfacility such as, for example, an airport, is the same person who laterappears at a departure area or who actually boards a departing vehicle(e.g., a commercial aircraft). At least one biometric reading orenrollment station 12 is set up at a check-in location or area 14, andat least one biometric reading station 16 is set up in the vicinity of agate or boarding area 18 where authorized passengers are allowed toenter a vehicle 30 for departure.

The meaning of the term “check-in” as used herein may vary depending onthe particular implementation. For example, a “check-in” may correspondto a time when a certain level of confidence has been established (asmay be required by an airline company) that a person who has presentedhimself or herself upon arriving at an airport, is actually the personthey claim to be. This may be accomplished, for example, by verifyingthe prospective passenger's previous trip history, by comparing theperson with his or her passport photo, or by verifying a biometric takenof the person at the station 12 against a biometric known to have beenpreviously acquired for the person. Other definitions of “check-in” mayalso apply in the present invention.

The station 12 at the check-in location 14 serves to capture a biometrictemplate of the prospective passenger. A commercially availablebiometric device provided at the station 12 is preferably capable ofimaging at least the passenger's iris, since the iris is known to bemore unique to a given individual than facial or fingerprint biometric.A suitable device for this purpose is the “HBox” system available fromGlobal Rainmaker Inc., of New York. The HBox system has the advantage ofacquiring both the face and the iris of an individual unobtrusively. Asmentioned earlier, there may be instances where iris scanning is notsuitable for certain individuals, and a device capable of acquiringother biometrics such as the passenger's face and/or fingerprint shouldbe available at the enrollment station 12.

When there is no pre-existing biometric template for the passenger, atemplate may be captured (or “enrolled”) for him or her by the device atthe station 12. This template is then stored in a trusted database 20.If the passenger already has a biometric template in an existing trusteddatabase 20, then a biometric template of the person may be read at thestation 12 simply for verification with the pre-existing template, or nofurther reading may occur at this time.

Once a biometric for the prospective passenger has either been acquired,or recalled from the database 20 by the station 12 at check-in, thepassenger is allowed to leave the check-in location 14. In cases wherethe passenger has previously enrolled in the system, the passenger maybypass the check-in location 14 and go directly to the second station16. Knowledge that the passenger's biometric template requires transferfrom the database 20 to the second station 16, may be provided by aknown passenger control system such as, e.g., a so-called DepartureControl System (DCS) used in air travel transportation systems. The DCScontains information concerning all passengers who are expected to leaveon every flight from every gate of an airport facility.

The passenger's biometric template is made available to at least thesecond biometric reading station 16 located near the boarding area 18for the transportation vehicle 30. At the second station 16, a biometricof the passenger is read by a second biometric device that may be thesame or similar to the device(s) provided at the first station 12. Thebiometric read at the second station 16 is then compared with a numberof biometric templates that have been forwarded from the secure database20, using the DCS information to determine at which boarding area (orgate) 18 each of the passengers are expected to appear for departure.

If a biometric match is found, then the passenger is allowed entry andhis or her record is flagged as being “about-to-board” with respect tothe transportation vehicle 30. If a biometric match is not found, thenthe passenger is refused entry to the vehicle 30. If afailure-to-acquire error occurs in the biometric reading process, thenstandard manual checking processes may be invoked. Since it iscontemplated that a vast majority of passengers will have theirindividual biometrics read successfully, minimal human resources areneeded to manage those occasions requiring manual verification.

Additional biometric reading devices may be set up at other strategiclocations, for example, at a security check point or other secure area,for continuously informing transportation employees of those passengerswho are present. This arrangement may be used, for example, for purposesof passenger management and preventing persons not authorized to travelfrom entering the secure areas.

It may not be necessary to maintain a master registration databaseand/or to associate a biometric template with a passenger name or otherpersonal information in a location out of the control of the individual.This simplifies compliance with privacy rules that vary widely fromcountry to country, and can limit the transfer of data from one locationto another. Also, this can be important in a transportation system wherepassengers frequently travel between countries under differentjurisdictions. For example, in one instantiation, the credentials of thepassenger are verified automatically (e.g., by a credit-card reader) ormanually (e.g., by a check-in agent) and at the same time biometric data(e.g., the iris and face) for the passenger is acquired. The biometricdata is stored, but is not associated with the passenger's name or otherinformation that can be used to identify the individual. The biometricdata is associated only with details of the journey on which thepassenger is booked, such as, e.g., a flight number, flight departuretime, and gate number. This biometric data is stored and sent to thebiometric acquisition device at the second station where passengerprovenance is to be verified.

For example, the second system may be located at the boarding gate. Whenthe passenger arrives at the gate, the biometric system acquiresbiometric data for the passenger and then performs one-to-many matchingthrough all the biometric data that is associated with the gate and theflight number, without the ability to associate a name or otheridentifying information to the individual. If biometric data acquired atthe second biometric system matches any of the biometric data acquiredat the first system where document verification was performed, then thepassenger is expected on that journey, even though the name of thepassenger is unknown to the system. Conversely, if a biometric match isnot found, then the passenger is not expected on that journey and can bedenied travel.

The above-mentioned second system requires biometrics that are capableof one-to-many matching, and are also capable of matching allindividuals. A preferred embodiment uses an unobtrusive biometricacquisition system for both system one and system two, such as the HBoxsystem provided by Global Rainmaker Inc, New York, N.Y., USA. Thissystem acquires data for both the face and the iris since, as mentioned,in some cases insufficient iris area is available to rely on recognitionalone, without additional information. This can be due to a physicalailment or other factors, and the face biometric is then used tosupplement the iris biometric.

It is noted that the use of “anonymous” biometrics as disclosed hereinfor transportation systems and facilities, can also be used to provideinformation to users—for example, a flight number may be stored with arecord as well as a generic “frequent flier” status of a givenpassenger, without any personal identifying information for thepassenger. In this way, preferred customers may be treated differently,or any flight information for any customer may be provided withoutknowing their identity, thus helping to overcome privacy regulations.

Another feature of the inventive technique resides in preventing theentry of passengers who are not able to pass immigration or other checkson arrival, as well as flagging in real time those passengers who pose agreater security threat than that posed by other passengers.Specifically, at the time of the passenger's check-in or earlier,personal information such as, e.g., the name and the address of thepassenger is collected. This information is then entered into anavailable manual or automatic background check system 22. Such systemstypically provide an assessment rating or level of the individual'sfitness-for-travel. One such system is the Personnel Assessment andScreening System (PASS) developed by L3 SyColeman.

The background check and the fitness-for-travel assessment are performedbefore the prospective passenger arrives at the boarding area 18. If thepassenger is required to check in, then any uncertainty concerning theprovenance of the passenger can be investigated immediately bydesignated employees at the check-in location 14 without affectingexisting security processes, and before accepting the passenger'sbaggage (if any) for check in.

In any event, it is preferred that the fitness-for-travel assessment becompleted before the passenger reaches a security checkpoint. In thelatter case, a biometric reading device provided at the checkpointacquires a biometric template. In a biometric match process, a search isperformed through a database of all passengers who are due to passthough the gate(s) serviced by the security checkpoint.

For example, the DCS comprises a database containing at least the name,flight number and gate number associated with the passenger. Thatinformation is used to index into the secure database 20 containing thebiometric information for the prospective passengers. The gate(s)serviced by the security checkpoint and the current time are used toindex into the DCS to determine which passengers are expected at thesecurity checkpoint. The biometric data for these passengers are thendownloaded into the biometric system. This process is performedrepeatedly over time such that new biometric data is added to thebiometric system at the checkpoint as later flights are expected toleave, and old biometric information corresponding to flights earlier inthe day are removed from the biometric system at the securitycheckpoint.

If a record is found, then the fitness-for-travel assessment may be usedby security personnel to determine a specific course of action withrespect to the passenger. If no record is found, then the subject hasnot checked in and is therefore not a valid passenger. For security orcustomer service reasons, a manual check may also be made in order toconfirm the rejection.

Various approaches may be taken for recovering costs involved in settingup and operating a system according to the invention. In one approach,costs for the vast majority (if not all) of the equipment andinformation technology (IT) services required to set up a passengerprovenance system according to the invention, are paid by an entityother than the carrier (e.g., airline company) that owns or operates thevehicle 30. The entity recovers the set up cost by levying a fee on eachpassenger. The fee may be paid directly by the passenger to the entity,or may be paid indirectly by the passenger to the carrier who in turncompensates the entity. The latter process may be implemented byallowing the carrier to levy a “passenger provenance fee” on the ticketpurchase price, wherein a portion (or all) of the fee is automaticallycredited to the entity.

In one example, the biometric identification of the user is not used asa means to bill the individual user. This approach can increase the costof travel to users of the biometric system, whereas the cost of travelremains the same for non-users of the biometric system who require morecostly manual processing to maintain passenger provenance. One possiblesolution is to charge a single fee on all tickets within certaincategories of travel, such as within domestic or international travel.This approach also simplifies or eliminates billing to the customerthereby reducing cost and increasing customer satisfaction.

The entity may be credited when it has performed the passengerprovenance service for the transportation carrier. This can be performedautomatically, for example, by treating the biometric read portion atthe time of check-in as a “transaction” that authorizes a payment to bemade from the carrier to the entity. The value of the transaction mayvary depending on the particular configuration of passenger provenancesystem that the entity purchases. For example, the transportationcarrier may require that the passenger background checks be performedrandomly, or be performed only in response to a particular concernexpressed by the check-in staff.

When a background check is performed, an additional “transaction” may berecorded so that a particular entity which performs the background checkis compensated via an additional fee for each individual checked. Theadditional fee may be recovered, for example, by increasing the standardlevy on all passengers so that, on average, the costs for all backgroundchecks as well as for the set-up and maintenance of the inventivepassenger provenance system, are recovered.

In summary, the process and system disclosed herein operate to ensurethat a given person who initially checks in at a transportation facilityis the same person who appears at a departure area or who actuallyboards a departing vehicle, without having to identify the passenger byhis/her name. That is, there is no need to associate the passenger'sname with a corresponding biometric template acquired by the system. Ifa biometric template A is “enrolled” at the facility's check-in locationfor flight F, then the system need only ensure that the same template Aappears later at the departure area for flight F. Measures are alsoprovided to prevent boarding of those passengers who may not be able topass through immigration or other background checks taken on arrival atthe facility, and to enable flagging in real time of certain passengerswho pose a potentially greater security threat in relation to otherpassengers. Approaches for recovering costs associated with theinventive process and system using means acceptable on the part ofpassengers and the transportation carrier, have also been described.

While the foregoing represents preferred embodiments of the invention,it will be understood by those skilled in the art that variousmodifications and changes may be made without departing from the spiritand scope of the invention, and that the invention includes all suchmodifications and changes as come within the scope of the followingclaims.

What is claimed:
 1. A method for ensuring the provenance of anindividual, comprising: acquiring a first biometric template at a firstlocation; storing the acquired first biometric template with ananonymous indicator comprising one of: a gate number or locationidentifier, a flight or transportation number, an immigration or otherstatus, a security risk, or a time specification, without any associatedinformation that uniquely identifies an owner of the first biometrictemplate; acquiring a second biometric template at a second location;determining, using the anonymous indicator stored with the firstbiometric template and without using any associated information thatuniquely identifies the owner, if the owner of the first biometrictemplate is expected at the second location; and performing, responsiveto determining that the owner of the first biometric template isexpected at the second location using the anonymous indicator, biometricmatching of the second biometric template at the second location withoutusing any associated information that uniquely identifies theindividual.
 2. The method of claim 1, wherein the first biometrictemplate corresponds to a biometric that is capable of one-to-manymatching.
 3. The method of claim 1, comprising performing biometricmatching of the second biometric template via one-to-many matching. 4.The method of claim 1, comprising storing the acquired first biometrictemplate at a location in the control of the owner of the firstbiometric template.
 5. The method of claim 1, comprising storing theacquired first biometric template in a secure database.
 6. The method ofclaim 5, comprising selecting a set of biometric templates of passengersexpected to be at the second location by indexing into the securedatabase using the anonymous indicator and without using any associatedinformation that uniquely identifies the owner of the first biometrictemplate, to transmit to the second location for the biometric matching.7. The method of claim 1, wherein acquiring the first biometric templatecomprises acquiring a biometric template of an iris.
 8. The method ofclaim 1, comprising denying access to the owner of the first biometrictemplate at the second location if the biometric matching of the secondbiometric template is unsuccessful.
 9. The method of claim 1, whereinacquiring the first biometric template further comprises establishing aconfidence level in the identity of the owner, that the owner isactually a person the owner claims to be.
 10. The method of claim 1,comprising ensuring privacy of the owner or reducing storagerequirements by storing the first biometric template without anyassociated information that uniquely identifies the owner of the firstbiometric template.
 11. A system for ensuring the provenance of anindividual, the system comprising: a first biometric acquisition deviceat a first location, configured to acquire a first biometric template,wherein the acquired first biometric template is stored with ananonymous indicator comprising one of: a gate number or locationidentifier, a flight or transportation number, an immigration or otherstatus, a security risk, or a time specification, without any associatedinformation that uniquely identifies an owner of the first biometrictemplate; and a second biometric acquisition device at a secondlocation, configured to acquire a second biometric template at a secondlocation, and further configured to, without using any associatedinformation that uniquely identifies the owner: determine if the ownerof the first biometric template is expected at the second location usingthe anonymous indicator, and perform biometric matching of the secondbiometric template at the second location responsive to determining thatthe owner of the first biometric template is expected at the secondlocation.
 12. The system of claim 11, wherein the first biometrictemplate corresponds to a biometric that is capable of one-to-manymatching.
 13. The system of claim 11, wherein the second biometricacquisition device is configured to perform biometric matching of thesecond biometric template via one-to-many matching.
 14. The system ofclaim 11, wherein the acquired first biometric template is stored at alocation in the control of the owner of the first biometric template.15. The system of claim 11, comprising a database configured to storethe acquired first biometric template.
 16. The system of claim 15,wherein the database is configured to select a set of biometrictemplates of passengers expected to be at the second location, totransmit to the second location for the biometric matching, by indexinginto the database using the anonymous indicator and without using anyassociated information that uniquely identifies the owner of the firstbiometric template.
 17. The system of claim 11, wherein the firstbiometric acquisition device is configured to acquire the firstbiometric template comprising a biometric template of an iris.
 18. Thesystem of claim 11, wherein the second biometric acquisition device isconfigured to deny access to the owner of the first biometric templateat the second location if the biometric matching of the second biometrictemplate is unsuccessful.
 19. The system of claim 11, wherein the firstbiometric acquisition device is configured to establish a confidencelevel in the identity of the owner of the first biometric template, thatthe owner is actually a person the owner claims to be.
 20. The system ofclaim 1, wherein the first biometric template is stored without anyassociated information that uniquely identifies the owner of the firstbiometric template, to ensure privacy of the owner or to reduce storagerequirements.